Overview

overview

10

Static

static

8

d00dd5a740...0b.exe

windows7_x64

10

d00dd5a740...0b.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d00dd5a7408f5d0e558065a0f26e34392d3ec7220d1043fc7c6c7332a8ff7e0b.exe

  • Size

    895KB

  • Sample

    210304-e2b1szchk6

  • MD5

    46c0218988f77018ce5572b99efbe24f

  • SHA1

    5ffec1cdd67f5eafea89b50dcce94f6d0faf582c

  • SHA256

    d00dd5a7408f5d0e558065a0f26e34392d3ec7220d1043fc7c6c7332a8ff7e0b

  • SHA512

    f969cfe04fc89c9c15797bf813f47ca0bdf3d79e593d7b5d4a0f7a08f33b15e3b674ffab8c87485b53e16b5d8b88092aedc0a6c4670e2f1836a46e07c5f06cb0

Score
10/10
evasionpersistencespywaretrojanupx

Malware Config

Targets

    • Target

      d00dd5a7408f5d0e558065a0f26e34392d3ec7220d1043fc7c6c7332a8ff7e0b.exe

    • Size

      895KB

    • MD5

      46c0218988f77018ce5572b99efbe24f

    • SHA1

      5ffec1cdd67f5eafea89b50dcce94f6d0faf582c

    • SHA256

      d00dd5a7408f5d0e558065a0f26e34392d3ec7220d1043fc7c6c7332a8ff7e0b

    • SHA512

      f969cfe04fc89c9c15797bf813f47ca0bdf3d79e593d7b5d4a0f7a08f33b15e3b674ffab8c87485b53e16b5d8b88092aedc0a6c4670e2f1836a46e07c5f06cb0

    Score
    10/10
    evasionpersistencespywaretrojanupx

    • Modifies system executable filetype association

      persistence

    • UAC bypass

      evasiontrojan

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Change Default File Association

1
T1042

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

4
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Hidden Files and Directories

2
T1158

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks